tofsee | 0f45b6ffef2caa4bf81e813baa4a22b331504c09a697822d3354ee1545f939ab

Analysis

max time kernel
31s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
20/01/2023, 22:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 328KB
Sample230120-2pdpssaa59
SHA256 0f45b6ffef2caa4bf81e813baa4a22b331504c09a697822d3354ee1545f939ab
MD5 c3084028c39cafa2c49e1dd340c592c0
SHA1 9c2b00678e8f30b095997176f6dc77d0f8025e87
SHA512 ca504bf09faf6d8e8952cf9986a507b7ea235d8cd92c182c1cbe86d5704ac3570f0185518a93be0a6f6e8ff6df23db1401b4390a8388c7d3990a5dcb5db373ad
SSDEEP 6144:tLNHtFKiNQbQ515nJTnqLgCoZsBDfwWNOHH:tZHSCQbabnJ6g6DfwWc
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

svartalfheim.top
jotunheim.name

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

New Service
T1050

Executes dropped EXE 1 IoCs

pid	Process
1636	msfatani.exe

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Modify Existing Service

T1031

pid	Process
896	netsh.exe

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1180	sc.exe
600	sc.exe
1300	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 364 wrote to memory of 112	364	file.exe	28
PID 364 wrote to memory of 112	364	file.exe	28
PID 364 wrote to memory of 112	364	file.exe	28
PID 364 wrote to memory of 112	364	file.exe	28
PID 364 wrote to memory of 584	364	file.exe	30
PID 364 wrote to memory of 584	364	file.exe	30
PID 364 wrote to memory of 584	364	file.exe	30
PID 364 wrote to memory of 584	364	file.exe	30
PID 364 wrote to memory of 1180	364	file.exe	32
PID 364 wrote to memory of 1180	364	file.exe	32
PID 364 wrote to memory of 1180	364	file.exe	32
PID 364 wrote to memory of 1180	364	file.exe	32
PID 364 wrote to memory of 600	364	file.exe	34
PID 364 wrote to memory of 600	364	file.exe	34
PID 364 wrote to memory of 600	364	file.exe	34
PID 364 wrote to memory of 600	364	file.exe	34
PID 364 wrote to memory of 1300	364	file.exe	36
PID 364 wrote to memory of 1300	364	file.exe	36
PID 364 wrote to memory of 1300	364	file.exe	36
PID 364 wrote to memory of 1300	364	file.exe	36
PID 364 wrote to memory of 896	364	file.exe	39
PID 364 wrote to memory of 896	364	file.exe	39
PID 364 wrote to memory of 896	364	file.exe	39
PID 364 wrote to memory of 896	364	file.exe	39
PID 1636 wrote to memory of 1864	1636	msfatani.exe	41
PID 1636 wrote to memory of 1864	1636	msfatani.exe	41
PID 1636 wrote to memory of 1864	1636	msfatani.exe	41
PID 1636 wrote to memory of 1864	1636	msfatani.exe	41

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:364
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\ifstgid\
  2⤵
  PID:112
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\msfatani.exe" C:\Windows\SysWOW64\ifstgid\
  2⤵
  PID:584
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create ifstgid binPath= "C:\Windows\SysWOW64\ifstgid\msfatani.exe /d\"C:\Users\Admin\AppData\Local\Temp\file.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:1180
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description ifstgid "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:600
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start ifstgid
  2⤵
  - Launches sc.exe
  PID:1300
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:896

C:\Windows\SysWOW64\ifstgid\msfatani.exe
C:\Windows\SysWOW64\ifstgid\msfatani.exe /d"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  PID:1864

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

New Service

T1050

Privilege Escalation

New Service

T1050

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

msfatani.exe

Path C:\Users\Admin\AppData\Local\Temp\msfatani.exe
Size 10.8MB
SHA256 0f15e3f3cb20b996d27e995a7eda347210a247224d10c0a483d9b670604c084c
MD5 423b5fda74cff98e3e4d140d8cd4fb0a
SHA1 25ec68ab864fb98a2a25b3fba078796fd94b3994
SHA512 2f13318e6cfb788319ad321f00fcfa093c7f5d196a0156dd5067fa27f4269e4abb4c2c38b8563b34722b863e720d7d0eedd023d71c078df67e09e3d6eb38dec0
SSDEEP 6144:DLNHtFKiNQbQ515nJTnqLgCoZsBDfwWNOHH0000000000000000000000000000c:DZHSCQbabnJ6g6DfwWc
MD5 SHA1 SHA512 SSDEEP

Submit Download

msfatani.exe

Path C:\Windows\SysWOW64\ifstgid\msfatani.exe
Size 10.8MB
SHA256 0f15e3f3cb20b996d27e995a7eda347210a247224d10c0a483d9b670604c084c
MD5 423b5fda74cff98e3e4d140d8cd4fb0a
SHA1 25ec68ab864fb98a2a25b3fba078796fd94b3994
SHA512 2f13318e6cfb788319ad321f00fcfa093c7f5d196a0156dd5067fa27f4269e4abb4c2c38b8563b34722b863e720d7d0eedd023d71c078df67e09e3d6eb38dec0
SSDEEP 6144:DLNHtFKiNQbQ515nJTnqLgCoZsBDfwWNOHH0000000000000000000000000000c:DZHSCQbabnJ6g6DfwWc
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/364-66-0x000000000054C000-0x0000000000561000-memory.dmp

Download

memory/364-67-0x0000000000400000-0x0000000000457000-memory.dmp

Download

memory/364-57-0x0000000000400000-0x0000000000457000-memory.dmp

Download

memory/364-55-0x000000000054C000-0x0000000000561000-memory.dmp

Download

memory/364-54-0x00000000757E1000-0x00000000757E3000-memory.dmp

Download

memory/364-56-0x0000000000220000-0x0000000000233000-memory.dmp

Download

memory/1636-72-0x00000000005BC000-0x00000000005D1000-memory.dmp

Download

memory/1636-73-0x0000000000400000-0x0000000000457000-memory.dmp

Download

memory/1864-70-0x0000000000080000-0x0000000000095000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads